/*

* Copyright (c) 2002-2008 Nokia Corporation and/or its subsidiary(-ies).

* All rights reserved.

* This component and the accompanying materials are made available

* under the terms of "Eclipse Public License v1.0"

* which accompanies this distribution, and is available

* at the URL "http://www.eclipse.org/legal/epl-v10.html".

*

* Initial Contributors:

* Nokia Corporation - initial contribution.

*

* Contributors:

*

* Description:  OCSP response decoder for given response

*

*/

#include "responsedecoder.h"

#include "oids.h"

#include "RoapOcsp.h"

#include <asn1dec.h>

#include <x509cert.h>

// Enum values in DER encoding of response status

enum

    {

    ESuccessfulEncoding = 0,

    EMalformedRequestEncoding = 1,

    EInternalErrorEncoding = 2,

    ETryLaterEncoding = 3,

    ESigRequiredEncoding = 5,

    EUnauthorisedEncoding = 6

    };

// Tag values in DER encoded response data

const TUint KResponseBytesTag = 0;

const TUint KCertificatesTag = 0;

const TUint KVersionTag = 0;

const TUint KResponderIDNameTag = 1;

const TUint KReponsderIDKeyHashTag = 2;

const TUint KResponseExtensionsTag = 1;

COCSPResponseDecoder* COCSPResponseDecoder::NewL(const TDesC8& aEncoding)

    {

    COCSPResponseDecoder* self = new (ELeave) COCSPResponseDecoder;

    CleanupStack::PushL(self);

    self->ConstructL(aEncoding);

    CleanupStack::Pop(self);

    return self;

    }

COCSPResponseDecoder::COCSPResponseDecoder()

    {

    }

COCSPResponseDecoder::~COCSPResponseDecoder()

    {

    delete iResponse;

    }

void COCSPResponseDecoder::ConstructL(const TDesC8& aEncoding)

    {

    iResponse = new (ELeave) COCSPResponse;

    // Populate CSignedObject data members

    iResponse->iKeyFactory = new (ELeave) TX509KeyFactory; // Unconventional class name

    iResponse->iEncoding = aEncoding.AllocL();

    TRAPD(error, DecodeOCSPResponseL(*iResponse->iEncoding));

    if (error == KErrArgument || error == KErrNotSupported)

        {

        // These arise from problems parsing the data in X509 or ASN1

        error = OCSP::EMalformedResponse;

        }

    if (error != KErrNone)

        {

        // Errors and our status codes go back to the client

        delete iResponse;

        iResponse = NULL;

        User::Leave(error);

        }

    }

COCSPResponse* COCSPResponseDecoder::TakeResponse()

    {

    COCSPResponse* result = iResponse;

    iResponse = NULL;

    return result;

    }

CArrayPtr<TASN1DecGeneric>* COCSPResponseDecoder::DecodeSequenceLC(const TDesC8& aEncoding)

    {

    CArrayPtr<TASN1DecGeneric>* items = NULL;

    // Check we've got a sequence

    TASN1DecGeneric decGen(aEncoding);

    decGen.InitL();

    if (decGen.Tag() != EASN1Sequence)

        {

        User::Leave(KErrArgument);

        }

    else

        {

        // Decode the sequence

        TASN1DecSequence decSeq;

        items = decSeq.DecodeDERLC(decGen);

        }

    return items;

    }

CArrayPtr<TASN1DecGeneric>* COCSPResponseDecoder::DecodeSequenceLC(const TDesC8& aEncoding,

                                                            const TInt aMinTerms,

                                                            const TInt aMaxTerms)

    {

    CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding);

    TInt count = items->Count();

    if (count < aMinTerms || count > aMaxTerms)

        {

        // User::Leave(KErrArgument);

        }

    return items;

    }

void COCSPResponseDecoder::DecodeOCSPResponseL(const TDesC8& aEncoding)

    {

    CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding, 1, 2);

    // Use integer decoding for enumerated

    TASN1DecInteger decInt;

    TInt status = decInt.DecodeDERShortL(*items->At(0));

    if (status == ESuccessfulEncoding)

        {

        if (items->Count() != 2)

            {

            User::Leave(OCSP::EMalformedResponse);

            }

        // Check tag on second part is [0]

        // We ignore any other parts in the sequence after that

        TASN1DecGeneric& responseBytesDec = *items->At(1);

        if (responseBytesDec.Tag() != KResponseBytesTag)

            {

            User::Leave(OCSP::EMalformedResponse);

            }

        // It's OK, so decode the response bytes object therein

        DecodeResponseBytesL(responseBytesDec.GetContentDER());

        }

    else

        {

        if (items->Count() != 1)

            {

            User::Leave(KErrArgument);

            }

        switch (status)

            {

            case EMalformedRequestEncoding:

                User::Leave(OCSP::EMalformedRequest);

            case EInternalErrorEncoding:

                User::Leave(OCSP::EServerInternalError);

                break;

            case ETryLaterEncoding:

                User::Leave(OCSP::ETryLater);

                break;

            case ESigRequiredEncoding:

                User::Leave(OCSP::ESignatureRequired);

                break;

            case EUnauthorisedEncoding:

                User::Leave(OCSP::EClientUnauthorised);

                break;

            default:

                User::Leave(OCSP::EMalformedResponse);

            }

        }

        CleanupStack::PopAndDestroy(items);

    }

void COCSPResponseDecoder::DecodeResponseBytesL(const TDesC8& aEncoding)

    {

    CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding, 2, 2);

    TASN1DecObjectIdentifier decOid;

    HBufC* oid = decOid.DecodeDERL(*items->At(0));

    CleanupStack::PushL(oid);

    if (*oid != KOCSPOidBasic)

        {

        User::Leave(OCSP::EUnknownResponseType);

        }

    TASN1DecGeneric& response = *items->At(1);

    if (response.Tag() != EASN1OctetString)

        {

        User::Leave(OCSP::EMalformedResponse);

        }

    DecodeBasicOCSPResponseL(response.GetContentDER());

    CleanupStack::PopAndDestroy(2, items); // oid, items

    }

void COCSPResponseDecoder::DecodeBasicOCSPResponseL(const TDesC8& aEncoding)

    {

    CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding, 3, 4);

    // First, the ResponseData object

    DecodeResponseDataL(items->At(0)->Encoding());

    // Continue, with the AlgorithmIdentifier

    iResponse->iSigningAlgorithm = CX509SigningAlgorithmIdentifier::NewL(items->At(1)->Encoding());

    // Now move on to the signature

    TASN1DecBitString encBS;

    iResponse->iSignature = encBS.ExtractOctetStringL(*items->At(2));

    // And finally, the certs (if they're there)

    if (items->Count() == 4)

        {

        // Check explicit tag [0]

        TASN1DecGeneric& certsDec = *items->At(3);

        if (certsDec.Tag() != KCertificatesTag)

            {

            User::Leave(OCSP::EMalformedResponse);

            }

        // It's OK, so decode the response bytes object therein

        DecodeCertificatesL(certsDec.GetContentDER());

        }

    CleanupStack::PopAndDestroy(items);

    }

void COCSPResponseDecoder::DecodeCertificatesL(const TDesC8& aEncoding)

    {

    TASN1DecGeneric dec(aEncoding);

    dec.InitL();

    if (dec.Tag() != EASN1Sequence)

        {

        User::Leave(OCSP::EMalformedResponse);

        }

    // Just stores a reference to the encoding

    iResponse->iSigningCerts.Set(dec.GetContentDER());

    }

void COCSPResponseDecoder::DecodeResponseDataL(const TDesC8& aEncoding)

    {

    TInt index = 0;

    // This is the signed data

    iResponse->iSignedData.Set(aEncoding);

    // Exclude 5 items in sequence - defaulted version v1 shouldn't appear in DER

    CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding, 3, 4);

    // First item is responderID choice, or maybe version

    TASN1DecGeneric& item0 = *items->At(index); // index = 0

    ++index;

    switch (item0.Tag())

        {

        case KResponderIDNameTag:

            // Set to Name DER encoding

            iResponse->iResponderIDName.Set(item0.GetContentDER());

            break;

        case KReponsderIDKeyHashTag:

            {

            // Set to KeyHash to value within the octet string

            TASN1DecGeneric decGen(item0.GetContentDER());

            decGen.InitL();

            iResponse->iResponderIDKeyHash.Set(decGen.GetContentDER());

            break;

            }

        case KVersionTag:

            {

            // skip the version, the next one should be responderID

            TASN1DecGeneric item1 = *items->At(index); // index = 1

            ++index;

            if (item1.Tag() == KResponderIDNameTag)

                {

                iResponse->iResponderIDName.Set(item1.GetContentDER());

                break;

                }

            else if (item1.Tag() == KReponsderIDKeyHashTag)

                {

                TASN1DecGeneric decGen(item1.GetContentDER());

                decGen.InitL();

                iResponse->iResponderIDKeyHash.Set(decGen.GetContentDER());

                break;

                }

            else

                {

                // falling through...

                }

            }

        default:

            User::Leave(OCSP::EMalformedResponse);

        }

    // ProducedAt is a GeneralizedTime

    TASN1DecGeneralizedTime decGT;

    iResponse->iProducedAt = decGT.DecodeDERL(*items->At(index)); // index = 1 | 2

    ++index;

    // Now the responses themselves

    DecodeResponsesL(items->At(index)->Encoding()); // index = 2 | 3

    ++index;

    // Continue if extensions exist

    if (items->Count() == index + 1) // index = 3 | 4

        {

        // Check tag on responseExtensions

        TASN1DecGeneric& item3 = *items->At(index);

        if (item3.Tag() != KResponseExtensionsTag)

            {

            User::Leave(OCSP::EMalformedResponse);

            }

        DecodeResponseExtensionsL(item3.GetContentDER());

        }

    CleanupStack::PopAndDestroy(items);

    }

void COCSPResponseDecoder::DecodeResponseExtensionsL(const TDesC8& aEncoding)

    {

    CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding);

    TInt count = items->Count();

    for (TInt index = 0; index < count; ++index)

        {

        DecodeResponseExtensionL(items->At(index)->Encoding());

        }

    CleanupStack::PopAndDestroy(items);

    }

void COCSPResponseDecoder::DecodeResponseExtensionL(const TDesC8& aEncoding)

    {

    CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding, 2, 3);

    // Get oid

    TASN1DecGeneric& oid = *items->At(0);

    if (oid.Tag() != EASN1ObjectIdentifier)

        {

        User::Leave(OCSP::EMalformedResponse);

        }

    TASN1DecObjectIdentifier oidDec;

    HBufC* oidVal = oidDec.DecodeDERL(oid);

    CleanupStack::PushL(oidVal);

    TBool critical = EFalse; // Default value of critical flag

    if (items->Count() == 3)

        {

        // The critical flag is specified - what does it say?

        TASN1DecBoolean decBool;

        critical = decBool.DecodeDERL(*items->At(1));

        }

    TASN1DecGeneric& extnVal = items->Count() == 3 ? *items->At(2) : *items->At(1);

    if (extnVal.Tag() != EASN1OctetString)

        {

        User::Leave(OCSP::EMalformedResponse);

        }

    // Check oid to decide what to do

    if (*oidVal == KOCSPOidNonce)

        {

        iResponse->iNonce.Set(extnVal.GetContentDER());

        }

    else if (*oidVal == KOCSPOidArchiveCutoff)

        {

        TASN1DecGeneralizedTime decGT;

        TInt pos = 0;

        iResponse->iArchiveCutoff = new (ELeave) TTime(decGT.DecodeDERL(extnVal.GetContentDER(), pos));

        }

    else if (critical)

        {

        // Didn't understand extension, and it was critical!  Erk!

        User::Leave(OCSP::EUnknownCriticalExtension);

        }

    CleanupStack::PopAndDestroy(2, items); // oidVal, items

    }

void COCSPResponseDecoder::DecodeResponsesL(const TDesC8& aEncoding)

    {

    CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding);

    TInt count = items->Count();

    for (TInt index = 0; index < count; ++index)

        {

        DecodeSingleResponseL(items->At(index)->Encoding());

        }

    CleanupStack::PopAndDestroy(items);

    }

void COCSPResponseDecoder::DecodeSingleResponseL(const TDesC8& aEncoding)

    {

    CArrayPtr<TASN1DecGeneric>* items = DecodeSequenceLC(aEncoding, 3, 5);

    COCSPResponseCertInfo* response = COCSPResponseCertInfo::NewLC(*items);

    User::LeaveIfError(iResponse->iCertInfos.Append(response));

    CleanupStack::Pop(response); // Now owned through iSingleResponses

    CleanupStack::PopAndDestroy(items);

    }